<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title>kali工具箱</title>
<script src="./static/bootstrap.min.js"></script>
<link rel="stylesheet" href="./static/main.css">
<link rel="stylesheet" href="./static/bootstrap.min.css">
<style type="text/css" id="syntaxhighlighteranchor"></style>
</head>
<main class="main-container ng-scope" ng-view="">
<div class="main receptacle post-view ng-scope">
<article class="entry ng-scope" ng-controller="EntryCtrl" ui-lightbox="">
<section class="entry-content ng-binding" ng-bind-html="postContentTrustedHtml">
<h2> extundelete包装说明</h2><p style="text-align: justify;"> extundelete是可以从一个ext3或ext4的分区恢复删除的文件的工具。在ext3和ext4文件系统是最常见的默认文件系统的Linux发行版样薄荷，Mageia，或Ubuntu。 extundelete使用存储在该分区的日志信息来尝试恢复已删除的分区中的文件。谁也不能保证，任何特定的文件就可以被取消删除，所以最好有一个良好的备份系统到位，或恢复您的文件后至少放一到位。 </p><p>资料来源：http://extundelete.sourceforge.net/ <br> <a href="http://extundelete.sourceforge.net/" variation="deepblue" target="blank">extundelete首页</a> | <a href="http://git.kali.org/gitweb/?p=packages/extundelete.git;a=summary" variation="deepblue" target="blank">卡利extundelete回购</a> </p><ul><li>作者：尼克案例</li><li>许可：GPL第二版</li></ul><h3>包含在extundelete包工具</h3><h5> extundelete - 实用程序从EXT3 / EXT4分区恢复删除的文件</h5><code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="790b16160d3912181510">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# extundelete --help<br>
Usage: extundelete [options] [--] device-file<br>
Options:<br>
  --version, -[vV]       Print version and exit successfully.<br>
  --help,                Print this help and exit successfully.<br>
  --superblock           Print contents of superblock in addition to the rest.<br>
                         If no action is specified then this option is implied.<br>
  --journal              Show content of journal.<br>
  --after dtime          Only process entries deleted on or after 'dtime'.<br>
  --before dtime         Only process entries deleted before 'dtime'.<br>
Actions:<br>
  --inode ino            Show info on inode 'ino'.<br>
  --block blk            Show info on block 'blk'.<br>
  --restore-inode ino[,ino,...]<br>
                         Restore the file(s) with known inode number 'ino'.<br>
                         The restored files are created in ./RESTORED_FILES<br>
                         with their inode number as extension (ie, file.12345).<br>
  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root<br>
                         of the partition and does not start with a '/' (it<br>
                         must be one of the paths returned by --dump-names).<br>
                         The restored file is created in the current<br>
                         directory as 'RECOVERED_FILES/path'.<br>
  --restore-files 'path' Will restore files which are listed in the file 'path'.<br>
                         Each filename should be in the same format as an option<br>
                         to --restore-file, and there should be one per line.<br>
  --output-dir 'path'    Restore files in the output dir 'path'.<br>
                         By default the restored files are created under current directory 'RECOVERED_FILES'.<br>
  --restore-all          Attempts to restore everything.<br>
  -j journal             Reads an external journal from the named file.<br>
  -b blocknumber         Uses the backup superblock at blocknumber when opening<br>
                         the file system.<br>
  -B blocksize           Uses blocksize as the block size when opening the file<br>
                         system.  The number should be the number of bytes.</code><h3> extundelete用法示例</h3><p>读取分区<b><i>（为/ dev / sda1的）和恢复</i></b> <b><i>（ -还原文件）</i></b>指定的文件名<b><i>​​（根/ importantfile）：</i></b> </p><code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="7c0e1313083c171d1015">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# extundelete /dev/sda1 --restore-file root/importantfile<br>
WARNING: Extended attributes are not restored.<br>
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.<br>
The partition should be unmounted to undelete any files without further data loss.<br>
If the partition is not currently mounted, this message indicates <br>
it was improperly unmounted, and you should run fsck before continuing.<br>
If you decide to continue, extundelete may overwrite some of the deleted<br>
files and make recovering those files impossible.  You should unmount the<br>
file system and check it with fsck before using extundelete.<br>
Would you like to continue? (y/n) <br>
y<br>
Loading filesystem metadata ... 192 groups loaded.<br>
Loading journal descriptors ... 29495 descriptors loaded.<br>
Writing output to directory RECOVERED_FILES/</code><div style="display:none">
<script src="//s11.cnzz.com/z_stat.php?id=1260038378&web_id=1260038378" language="JavaScript"></script>
</div>
</main></body></html>
